Rename discriminator to waf everywhere (closes #312)

The command is now `sww waf`, and the package is `internal/waf`. Types,
functions, files, tests, comments, docs, the Dockerfile, the runit
script, `script/`, compose examples, the log field `waf_line` and the
`X-From-Waf` test header follow. No behaviour changes, and no setting
changes name: rproxy already finds the waf through `SWRP_WAF_BACKEND`.

Done with one `sed -i` (Discriminator and DISCRIMINATOR to WAF,
discriminator to waf) over the files `git grep -i discriminator`
listed, as sneak allowed for this rename, then `git mv` for the
package and files.

Model: opus-5-5

docs/admin-endpoints.md

@@ -1,8 +1,8 @@
 # Admin endpoints
 
-The endpoints under `/_sww/`, what each takes and what each answers.
-`sww discriminator` answers them at its own address, on the private network.
-"Admin endpoints" in [`SPEC.md`](../SPEC.md) says how their tokens work.
+The endpoints under `/_sww/`, what each takes and what each answers. `sww waf`
+answers them at its own address, on the private network. "Admin endpoints" in
+[`SPEC.md`](../SPEC.md) says how their tokens work.
 
 - `GET /_sww/healthz`: `200` and `ok`, to anyone.
 - `GET /_sww/metrics`: the metrics, for `SWW_METRICS_TOKEN` (see
@@ -20,10 +20,10 @@ The endpoints under `/_sww/`, what each takes and what each answers.
     - one that names an IPv4-mapped netblock, or an address with a zone.
 - `DELETE /_sww/bans/<client>`: lifts every active ban covering the address
   `<client>`. It answers `404` when none is active.
-- `GET /_sww/clients/<ip>`: what `discriminator` knows of the client. Under
-  `client`, its counters and history as `clients.json` holds them, or `null`
-  when `clients.json` does not hold it. Under `bans`, every ban covering the
-  address, with its notes.
+- `GET /_sww/clients/<ip>`: what `waf` knows of the client. Under `client`, its
+  counters and history as `clients.json` holds them, or `null` when
+  `clients.json` does not hold it. Under `bans`, every ban covering the address,
+  with its notes.
 - `POST /_sww/report`: takes `rproxy`'s report, without a token. It answers
   `204`, or `400` to a body that is no report (see "The report" in
   [`SPEC.md`](../SPEC.md)).
@@ -32,29 +32,29 @@ No check runs on these requests. A missing or wrong token is answered `401`. An
 endpoint whose token is unset answers `404`, as does any other path.
 
 `sww rproxy` answers only the health check of these, at its own address. It asks
-`discriminator` about any other request under `/_sww/`. One that passes the
-checks is answered `404`, so that the app never sees that prefix (see "`rproxy`"
-in [`SPEC.md`](../SPEC.md)).
+`waf` about any other request under `/_sww/`. One that passes the checks is
+answered `404`, so that the app never sees that prefix (see "`rproxy`" in
+[`SPEC.md`](../SPEC.md)).
 
 ## Examples
 
-With `SWW_ADMIN_TOKEN` set, the token in `$TOKEN`, and `discriminator` reached
-as `discriminator:8080` on its network:
+With `SWW_ADMIN_TOKEN` set, the token in `$TOKEN`, and `waf` reached as
+`waf:8080` on its network:
 
 ```sh
 # Every ban.
-curl -H "Authorization: Bearer $TOKEN" http://discriminator:8080/_sww/bans
+curl -H "Authorization: Bearer $TOKEN" http://waf:8080/_sww/bans
 
 # Ban 203.0.113.0/24 for seven days.
 curl -H "Authorization: Bearer $TOKEN" \
     --json '{"netblock": "203.0.113.0/24", "duration": "7d", "reason": "probes for logins"}' \
-    http://discriminator:8080/_sww/bans
+    http://waf:8080/_sww/bans
 
 # Lift the bans on 203.0.113.9.
 curl -H "Authorization: Bearer $TOKEN" -X DELETE \
-    http://discriminator:8080/_sww/bans/203.0.113.9
+    http://waf:8080/_sww/bans/203.0.113.9
 
-# What discriminator knows of 203.0.113.9.
+# What waf knows of 203.0.113.9.
 curl -H "Authorization: Bearer $TOKEN" \
-    http://discriminator:8080/_sww/clients/203.0.113.9
+    http://waf:8080/_sww/clients/203.0.113.9
 ```